All vulnerabilities
CVE-2026-106499GHSA-mfvq-x7vr-rgqg

@backstage/plugin-scaffolder-backend: Backstage: Secret-derived values may be exposed in scaffolder task logs

backstage @backstage/plugin-scaffolder-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.0Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 4.1.0@backstage/plugin-scaffolder-backend, npmGitHubnpm install @backstage/plugin-scaffolder-backend@4.1.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted in task logs, exposing those values to users with access to the resulting task logs.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

  • Restrict permission to create or update Template entities to fully trusted parties, as recommended by the Backstage threat model.
  • If that restriction cannot be guaranteed, remove sensitive values from scaffolder.defaultEnvironment.secrets until a patched version is available.

No complete workaround is known that preserves both untrusted template authoring and access to sensitive default-environment secrets.

Text from GitHub Advisory Database

Affected versions 4

  • @backstage/plugin-scaffolder-backend, npm< 4.1.0GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-scaffolder-backendaffected: < 4.1.0CVE List
  • @backstage/plugin-scaffolder-backend, npmfrom first release, fixed in 4.1.0OSV

References 5